Bodies still littered the lobby and ground floor of the Westgate Mallaround 10:30 p.m. (3:30 p.m. ET), more than 10 hours after the attack began, according to the Kenya National Disaster Operation Centre.

There were 39 confirmed dead and 150 wounded at that point, according to Kenya’s president, who added that his close relatives are among those killed. Two gunmen, including one who was detained after being shot, are also dead.

With the situation far from settled, it’s very possible the death toll might grow.

Authorities said that as many as 36 hostages are being held, according to journalist Martin Cuddihy of the Australian Broadcasting Corp., who was at the scene and interviewed by CNN.

Al-Shabaab, an al-Qaeda-linked militant group based in Somalia, claimed responsibility for the carnage and vowed not to negotiate with Kenyan authorities. It claimed that “all Muslims” were escorted from the mall before the attack — suggesting that its targets were people who didn’t believe in their extreme form of Islam.

“The Mujahideen are still strong inside #Westgate Mall and still holding their ground,” the group said late Saturday via Twitter. “All praise is due to Allah!”

Kenyan authorities, though, insist they have the upper hand, where it’s now early Sunday morning.

Police tweeted that the attackers “have been isolated and pinned down in a room by security forces.” And Joseph Ole Lenku, the national government’s cabinet secretary for interior and coordination, hinted that the worst should be over.

“Our security forces have taken control of the situation,” Lenku said.

“Attackers of Westgate shopping mall have been isolated and pinned down in a room by security forces in the ongoing operation,” the national police said on Twitter.

Kenya’s president, Uhuru Kenyatta, blasted “the despicable perpetrators of this cowardly act (who) hoped to intimidate, divide and cause despondency among Kenyans and would like to (create) a closed, fearful and fractured society.”

Kenya is no stranger to terrorism, including a 1998 bombing at the U.S. Embassy in Nairobi that left 213 dead and other attacks before and since tied to al Qaeda and related groups.

In a televised speech late Saturday, Kenyatta said his nation has “overcome” such attacks before, refusing to budge from its values or relinquish his security. And it will do so again, he promised.

“We shall hunt down the perpetrators wherever they run to,” the president said. “We shall get them, and we shall punish them for this heinous crime.

“Westgate Mall lends itself a serene and safe environment away from the city centre,” the mall’s official website states.

That may have been true before — while there had been warnings, the high-end mall filled with more than 80 stores and restaurants had never been targeted. But it couldn’t have been further from the truth Saturday.

Rattles of gunshots beginning around noon shattered any sense of peace or normalcy among those picking up groceries, savoring their lunch and browsing through the racks at stores.

Uche Kaigwa-Okoye was sipping his coffee when he heard what first sounded like a fallen table, then the continuing rat-a-tat of gunfire. As the gunshots became louder, people began screaming and running for the exits.

Some ran outside, only to turn around and headed back into the four-story mall when they realized bullets were flying there as well. Kaigwa-Okoye was among them, joining about 20 people who took shelter in a bathroom cubicle.

“They had grenades, and it was really, really loud,” he told CNN, adding that he noticed tear gas in the corridors as well. “All of us felt like they were close.”

As people texted family and friends outside the mall, word spread that nobody could be trusted — and, even if the good guys could be sorted from the bad guys, the barrage of intermittent gunfire made any escape seem futile at times.

Sara Head, a Washington resident, experienced much of the same horror in the mall’s parking garage. As her car pulled up, she and others heard the rattle of gunfire — prompting them to crawl underneath and sneak behind cars before getting into a stairwell. She had company, including two people bleeding from gunshot wounds.

Eventually, the stairwell lights turned back on and the door to a nearby supermarket opened, so they dashed through the market and a nearby loading dock to safety.

“There was blood throughout the supermarket as we exited,” Head recalled. “… It wasn’t clear if it was OK to exit. I was short of sheep following.”

Soldiers crawl under cars, copters fly overhead

By then it was clear that the once shiny, pristine Westgate mall had become a war zone.

That was shown as Kenyan soldiers in military fatigues, their guns cocked, crawled under cars to get closer to the mall, guns cocked.

Surveillance helicopters flew overhead.

Police took those rescued from the building to a secluded place for vetting to ensure they were not attackers. They streamed away from the mall in a straight line, arms raised up in the air.

The military asked local media not to televise anything live because the gunmen are watching the screens in the mall, which is popular with expatriates and the wealthy.

“We urge Kenyans to keep off Westgate mall, adjacent roads and its environs until further notice,” the interior ministry said in a statement.

An unknown number of Americans were among those injured, but the majority of casualties are Kenyan, authorities said.